Virus Name: Lurve
V Status: Rare
Discovered: March, 1993
Symptoms: .COM file growth; decrease in total system & available free
memory; DOS CHKDSK file allocation errors
Eff Length: 718 Bytes
Type Code: PRhC - Parasitic Resident .COM Infector
Detection Method: F-Prot, Sweep, AVTK, ViruScan, PCScan,
IBMAV, NAV, NAVDX, VAlert, ChAV,
Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected programs
The Lurve, or ARCV-718, virus was submitted in March, 1993, and is
from England. Lurve is a memory resident semi-stealth virus which
infects .COM programs, but not COMMAND.COM.
When the first Lurve infected program is executed, the Lurve virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary, hooking interrupt 21. Total system
and available free memory, as indicated by the DOS CHKDSK program,
will have decreased by 2,048 bytes. Interrupt 12's return will not
have been moved.
Once the Lurve virus is memory resident, it will infect .COM programs
when they are executed or opened for any reason. Infected programs
will have a file length increase of 718 bytes, however the file
length increase is hidden when the virus is memory resident. The
Lurve viral code will be located at the end of the file. The file's
date and time in the DOS disk directory listing will not be altered.
The following text strings are encrypted within the Lurve viral code:
"Hello Dr. Sol."
"Lurve U lots"
"(c) 1992 ARCV."
"Apache sez Hi(Dos)"
When the DOS CHKDSK program is executed with the Lurve virus in
memory, it will detect file allocation errors on all infected
It is unknown what Lurve does besides replicate.